What to Include in Product Security Testing
What is included in a Product Security Test , often referred to as "the scope", greatly depends on the product’s features and the customer’s specific security objectives. Each test is tailored to the technology stack, threat landscape, and operational context of the product, ensuring relevant and high-impact coverage.
During our planning with the customer and what we discover as penetration testers, we might find the testing to include a variety of elements, all which our team can assess. These layers are on hardware, infrastructure, software and network, as the picture below shows:
Digging deeper into the layers, we see evidence of deeper layers, which our team can help assess. Read more about them in the grouping below.
Our hardware testing focuses on uncovering weaknesses across critical physical components. This includes chips and system-on-chips (SoC), memory such as DRAM and SRAM, storage types like ROM, EEPROM, Flash, and eMMC, as well as internal buses and SPI interfaces. Each of these layers exposes unique attack surfaces, and our specialized testing ensures they are thoroughly evaluated for security before your product reaches the field.
The Full Stack Peneration Tester
Product Security Testing, sometimes referred to as Device or Hardware Security Testing, is a specialized area within penetration testing. It requires a skilled team to assess a broad range of technologies, attack surfaces, and potential threat scenarios, ensuring that products are evaluated against both known vulnerabilities and complex, real-world attack paths across hardware and software layers.
Instead of relying on a single individual to conduct penetration testing, River Security’s methodology is built around structured collaboration. Our approach enables fine-grained prioritization and efficient distribution of tasks across a skilled team, ensuring deeper coverage, faster execution, and a more thorough assessment of complex products.
Our goal is clear and focused: to ensure that our customers' security posture aligns with the level users expect and assume. By identifying and addressing vulnerabilities early, we help prevent issues from being exploited in the wild- protecting both the product and the trust placed in it.
River Security Hardware Testing Lab
To uncover the kinds of vulnerabilities that matter at the hardware level, specialized tools and a controlled environment are essential. Our dedicated hardware lab enables deep technical analysis using techniques like fault injection, bus monitoring, and chip-level interrogation. This setup allows us to go far beyond surface checks, identifying weaknesses in components such as memory, storage, and internal communication pathways. This means greater assurance that your product has been rigorously tested under real-world attack conditions, before it ever reaches your customers.
At River Security, our dedicated lab is equipped to safely and thoroughly explore the full attack surface of the products we test. With specialized tools and controlled conditions, we can perform in-depth hardware and embedded security analysis while ensuring both the product and our equipment remain protected throughout the process.
Testimonials
Don't let us do the talking, but instead the customers. Take a look at your testimonials page and you will find many customer cases and testimonials. A carousel of our latest testimonals can be seen below.
Sparebanken Vest
“…That’s where River Security comes in, offering their Active Focus service to keep us ahead of the curve with a constantly evolving attack surface, and even helping us to uncover the unknown…”
Mesta
“The team is very knowledgeable and has taught us a lot when it comes to proactive cyber security. They are agile and clearly has a lot of competence within their field, and we are happy to have them on our side in the ever-changing threat landscape.”
Azets
“One of the differentiating features of River Security is that they focus on real threats and areas that need attention – so we not only know about vulnerabilities, dark web disclosures and other issues, but also how they will affect our business.”
Glitre Nett
“River Security conducted a Digital Footprint and an internal Penetration Test on our systems. Our experience with the team from River Security shows that they are highly skilled professionals. Throughout the project we really appreciated their enthusiasm and great interaction with our own team.”
Sogn og Fjordane Energi
“As the uncertainty surrounding the situation in Europe continues, security in critical infrastructure is of higher importance than ever. Having an external party look at your company from an attackers’ point of view is crucial to identify weaknesses, but also to confirm good measures already in place.”
Skagerak Energi
“We had the pleasure of hosting a Secure Coding Session for our developers, led by Chief Hacking Officer Chris Dale from River Security AS. The workshop from River Security was tailored to our development team and provided valuable insights into best practices for writing robust and secure code. “
Statkraft
River Security is one of a few suppliers in a program delivering cyber security services to Statkraft AS.
Ward & Burke
“The main benefit of the service is an increased level of comfort knowing that someone is consistently monitoring our systems and ‘watching our back’ for potential threats. This proactive approach allows us to focus more on our core business operations without constantly worrying about potential security gaps.”
InfoTiles
“InfoTiles chose to work with River Security for our most recent penetration testing, because Vegard quickly understood our objectives and delivered a work plan that complements the agility critical to scaling companies. Chris’ findings were clearly presented, helping us understand their significance, and accompanied by meaningful guidance to implement improvements. InfoTiles serves customers with critical…
Aneo
“We are very pleased with the collaboration with River Security. Their team’s deep expertise in cybersecurity, combined with concrete, actionable advice, has significantly strengthened our security posture. The dialogue has always been insightful, especially their ability to challenge assumptions and navigate uncertainty with clarity and professionalism. River Security doesn’t just deliver services, they bring value…